{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21258", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-12-11T21:02:05.737Z", "datePublished": "2026-02-10T17:51:18.057Z", "dateUpdated": "2026-05-11T21:25:17.097Z"}, "containers": {"cna": {"title": "Microsoft Excel Information Disclosure Vulnerability", "datePublic": "2026-02-10T16:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:ltsc:*:*:*", "versionStartIncluding": "16.0.0.0", "versionEndExcluding": "16.0.10417.20097"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2019:*:*:*:*:*:*:*:*", "versionStartIncluding": "19.0.0", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "16.106.26020821"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*", "versionStartIncluding": "16.0.0", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*", "versionStartIncluding": "16.0.0", "versionEndExcluding": "16.106.26020821"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:excel_2016:*:*:*:*:*:*:x86:*", "versionStartIncluding": "16.0.0.0", "versionEndExcluding": "16.0.5539.1002"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Excel 2016", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.0.0", "lessThan": "16.0.5539.1002", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office 2019", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "19.0.0", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC 2021", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC 2024", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.0", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2021", "versions": [{"version": "16.0.1", "lessThan": "16.106.26020821", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2024", "versions": [{"version": "16.0.0", "lessThan": "16.106.26020821", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Office Online Server", "versions": [{"version": "16.0.0.0", "lessThan": "16.0.10417.20097", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-20: Improper Input Validation", "lang": "en-US", "type": "CWE", "cweId": "CWE-20"}, {"description": "CWE-125: Out-of-bounds Read", "lang": "en-US", "type": "CWE", "cweId": "CWE-125"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-05-11T21:25:17.097Z"}, "references": [{"name": "Microsoft Excel Information Disclosure Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21258"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T15:25:23.136100Z", "id": "CVE-2026-21258", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:25:37.742Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21258", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T15:25:23.136100Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:25:30.911Z"}}], "cna": {"title": "Microsoft Excel Information Disclosure Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "versions": [{"status": "affected", "version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom"}], "platforms": ["32-bit Systems", "x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft Excel 2016", "versions": [{"status": "affected", "version": "16.0.0.0", "lessThan": "16.0.5539.1002", "versionType": "custom"}], "platforms": ["32-bit Systems", "x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft Office 2019", "versions": [{"status": "affected", "version": "19.0.0", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom"}], "platforms": ["32-bit Systems", "x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC 2021", "versions": [{"status": "affected", "version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom"}], "platforms": ["32-bit Systems", "x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC 2024", "versions": [{"status": "affected", "version": "16.0.0", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom"}], "platforms": ["32-bit Systems", "x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2021", "versions": [{"status": "affected", "version": "16.0.1", "lessThan": "16.106.26020821", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2024", "versions": [{"status": "affected", "version": "16.0.0", "lessThan": "16.106.26020821", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Office Online Server", "versions": [{"status": "affected", "version": "16.0.0.0", "lessThan": "16.0.10417.20097", "versionType": "custom"}]}], "datePublic": "2026-02-10T16:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21258", "name": "Microsoft Excel Information Disclosure Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}, {"lang": "en-US", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:ltsc:*:*:*", "vulnerable": true, "versionEndExcluding": "16.0.10417.20097", "versionStartIncluding": "16.0.0.0"}, {"criteria": "cpe:2.3:a:microsoft:office_2019:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases", "versionStartIncluding": "19.0.0"}, {"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases", "versionStartIncluding": "16.0.1"}, {"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*", "vulnerable": true, "versionEndExcluding": "16.106.26020821", "versionStartIncluding": "16.0.1"}, {"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*", "vulnerable": true, "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases", "versionStartIncluding": "16.0.1"}, {"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*", "vulnerable": true, "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases", "versionStartIncluding": "16.0.0"}, {"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*", "vulnerable": true, "versionEndExcluding": "16.106.26020821", "versionStartIncluding": "16.0.0"}, {"criteria": "cpe:2.3:a:microsoft:excel_2016:*:*:*:*:*:*:x86:*", "vulnerable": true, "versionEndExcluding": "16.0.5539.1002", "versionStartIncluding": "16.0.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-05-11T18:09:56.305Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21258", "state": "PUBLISHED", "dateUpdated": "2026-05-11T18:09:56.305Z", "dateReserved": "2025-12-11T21:02:05.737Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-02-10T17:51:18.057Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*", "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*", "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x64:*", "matchCriteriaId": "CD88F667-6773-4DB7-B6C3-9C7B769C0808", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x86:*", "matchCriteriaId": "B342EF98-B414-44D0-BAFB-FCA24294EECE", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*", "matchCriteriaId": "CF5DDD09-902E-4881-98D0-CB896333B4AA", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*", "matchCriteriaId": "26A3B226-5D7C-4556-9350-5222DC8EFC2C", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*", "matchCriteriaId": "851BAC4E-9965-4F40-9A6C-B73D9004F4C1", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*", "matchCriteriaId": "23B2FA23-76F4-4D83-A718-B8D04D7EA37B", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*", "matchCriteriaId": "BF0E8112-5B6F-4E55-8E40-38ADCF6FC654", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*", "matchCriteriaId": "D31E509A-0B2E-4B41-88C4-0099E800AFE6", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*", "matchCriteriaId": "017A7041-BEF1-4E4E-AC8A-EFC6AFEB01FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*", "matchCriteriaId": "EF3E56B5-E6A6-4061-9380-D421E52B9199", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "0213E443-C4CD-41DC-9C07-B2D85B284389", "versionEndExcluding": "16.0.10417.20097", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally."}], "id": "CVE-2026-21258", "lastModified": "2026-02-11T19:12:56.623", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "secure@microsoft.com", "type": "Primary"}]}, "published": "2026-02-10T18:16:27.637", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21258"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-125"}], "source": "secure@microsoft.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": ["32-bit_systems", "x64-based_systems"], "status": "affected", "versions": {"scheme": "generic", "value": "[16.0.1,https://aka.ms/OfficeSecurityReleases)"}}], "product": "365_apps", "vendor": "microsoft"}, {"configurations": [{"platform": ["32-bit_systems", "x64-based_systems"], "status": "affected", "versions": {"scheme": "generic", "value": "[16.0.0.0,16.0.5539.1002)"}}], "product": "excel_2016", "vendor": "microsoft"}, {"configurations": [{"platform": ["32-bit_systems", "x64-based_systems"], "status": "affected", "versions": {"scheme": "generic", "value": "[19.0.0,https://aka.ms/OfficeSecurityReleases)"}}], "product": "office_2019", "vendor": "microsoft"}, {"configurations": [{"platform": ["x64-based_systems", "32-bit_systems"], "status": "affected", "versions": {"scheme": "generic", "value": "[16.0.1,https://aka.ms/OfficeSecurityReleases)"}}], "product": "office_2021", "vendor": "microsoft"}, {"configurations": [{"platform": ["32-bit_systems", "x64-based_systems"], "status": "affected", "versions": {"scheme": "generic", "value": "[16.0.0,https://aka.ms/OfficeSecurityReleases)"}}], "product": "office_2024", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16.0.1,16.106.26020821)"}}], "product": "office_macos_2021", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16.0.0,16.106.26020821)"}}], "product": "office_macos_2024", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16.0.0.0,16.0.10417.20097)"}}], "product": "office_online_server", "vendor": "microsoft"}], "analysis": {"en": {"generated_at": "2026-04-15T16:35:56.532943+00:00", "value": {"mitigation_remediation": ["Apply the Microsoft update that addresses CVE\u20112026\u201121258 via the official Microsoft update channel.", "Ensure that automatic updates are enabled for Microsoft Office to receive security patches promptly.", "If a timely patch is unavailable, restrict user permissions to limit local execution of untrusted Excel files until the vulnerability is remediated."], "summary": {"action": "Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The affected products include Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft Office Online Server. No specific version numbers are provided in the CNA data, so the issue applies broadly to the mentioned releases.", "description_and_impact": "The vulnerability is an improper input validation flaw that allows a local attacker to read sensitive information from memory or data structures that should be protected. It is classified under CWE-125 and CWE-20, indicating out\u2011of\u2011bounds reads and generic input validation weaknesses. The confirmed effect is that an unauthorized user with local access to a Microsoft Office Excel environment can observe confidential data that the application handles but should not expose to the user, thereby undermining confidentiality.", "risk_and_exploitability": "The CVSS score of 5.5 indicates a moderate risk. Exploit probability, as shown by EPSS, is less than 1%, suggesting that active exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog, further indicating lower operational priority. The primary attack vector is local; an adversary must already have been on the same system or have the ability to run malicious code within the Excel process to leverage the flaw."}}}}, "created": "2026-02-12T12:32:12.248112+00:00", "updated": "2026-04-15T17:45:10.846343+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$365_apps", "microsoft$PRODUCT$excel_2016", "microsoft$PRODUCT$office_2019", "microsoft$PRODUCT$office_2021", "microsoft$PRODUCT$office_2024", "microsoft$PRODUCT$office_macos_2021", "microsoft$PRODUCT$office_macos_2024", "microsoft$PRODUCT$office_online_server"]}